Read the explanation
The auditor applies ten regular-expression rules locally to the entered text. In a fabricated fixture with one example-dot-org email and a dummy three-two-four digit identifier, the rules find two matches: email score twenty and social-security-format score thirty five, totaling fifty five. Bars encode assigned scores at five pixels per point. A provider base eighty five contributes point forty five times that value, thirty eight point two five. Any positive finding score adds fifty plus half the finding score, capped at forty five for that last term, then the total is rounded and capped at one hundred. This produces Critical one hundred for the fixture. It is an authored exposure score rather than the probability of a leak or an audit of a real service. Changing only the platform to its enterprise-API row selects a static base five and different policy labels. With the same two findings, score becomes eighty after rounding two point two five plus fifty plus twenty seven point five. Bars compare one hundred and eighty at three pixels per score point. A clean input on base five gives two. These results follow a fixed policy table; the auditor makes no request to a provider, checks no account setting, region, contract or retention enrollment, and does not verify current policy. Its statements about training, advertising, retention and unlearning should not be treated as established facts from this offline source audit. Switching a dropdown does not change the actual privacy guarantees of any account. The replacement routine substitutes an email mask and an identifier mask for the two fabricated matches. Bars encode two detected matches and two replacement markers at sixty pixels per item. It leaves the original textarea intact, and export records masked finding categories plus the current sanitized preview, not the raw match token. Synthetic mode replaces matches with predefined dummy strings; a later input or platform change regenerates normal redaction. Pattern scanning cannot detect every secret or identifying narrative: key syntax, number validity and semantic personal context are not comprehensively validated, and overlapping matches may be counted independently. No detected matches therefore does not certify safe-to-send text. Native input, platform changes, real JSON download and four responsive widths preserve original behavior; clipboard, provider-policy correctness and exhaustive privacy guarantees are outside this local proof.